Volerion logoVolerion
Volerion logoVolerion

CISA Thorium Improper Certificate Validation in Elasticsearch Connections

Vulnerability

A vulnerability exists in CISA Thorium versions 1.0.0 prior to 1.1.2, where the application fails to validate TLS certificates when connecting to Elasticsearch. This flaw allows an unauthenticated attacker with access to a Thorium cluster to impersonate the Elasticsearch service. The issue has been addressed in version 1.1.2.

Impact

Exploitation of this vulnerability could lead to unauthorized impersonation of the Elasticsearch service, potentially allowing for malicious actions to be taken under the guise of a legitimate service.

Remediation

Users can upgrade to CISA Thorium version 1.1.2 to address this vulnerability.

Added: Sep 17, 2025, 5:21 PM
Updated: Sep 17, 2025, 5:21 PM

Vulnerability Rating

Custom Algorithm
spread
0.0
impact
1.3
exploitability
6.9
remediation
7.7
relevance
0.5
threat
3.2
urgency
2.9
incentive
1.7

Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.